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MANSFIELD, Justice. 

This case requires us to decide where disclosure ends and where 
confidentiality begins under the Iowa Open Records Act and the Federal 
Educational Rights and Privacy Act (FERPA). See 20 U.S.C. § 1232g 
(2006 and Supp. 2010); Iowa Code §§ 22.2, .7, .9 (2007). In October 
2007, two University of Iowa football players were accused of sexually 
assaulting another student in a campus dorm room. This incident led to 
a criminal investigation, criminal charges, and the conviction of one 
player on a charge of assault with intent to inflict serious injury and the 
other on a charge of simple assault. This incident also led to internal 
actions and responses by the University, external criticism of the 
University, and a special counsel investigation and report. Finally, this 
incident led to the present lawsuit. 

The present litigation concerns Open Records Act requests that the 
Iowa City Press-Citizen served on the University after reports of the 
incident surfaced. Dissatisfied with the University's initial response to 
those requests, the Press-Citizen filed suit. The lawsuit resulted in more 
documents being produced and others being submitted for in camera 
review by the district court. The court then ordered additional 
documents produced, in some instances with redactions. 

The University has appealed that order in part. It argues that 
FERPA prohibits the disclosure of the remaining documents, including 
even redacted versions of "education records" where the identity of the 
student is known to the recipient. The Press-Citizen counters that 
FERPA does not supersede any obligation to produce records under the 
Open Records Act, and in any event, the University has misinterpreted 
FERPA. For the reasons discussed herein, we ultimately agree with the 
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University's arguments as to the meaning and force of FERPA, and 
therefore reverse the district court's judgment in part. 
I. Background Facts and Proceedings. 

During the early morning hours of Sunday, October 14, 2007, a 
female student-athlete was allegedly sexually assaulted at the Hillcrest 
dormitory at the University of Iowa. Two University of Iowa football 
players who were accused of involvement were suspended and later 
dismissed from the team. A criminal investigation resulted in both men 
being charged. One ultimately pled guilty to assault with intent to inflict 
serious injury, and the other was convicted of simple misdemeanor 
assault following a jury trial. See Iowa Code §§ 708.1, 708.2(1), 708.2(6). 

Numerous University officials were informed of the incident by 
Monday, October 15, 2007; however, the parents of the student-athlete 
believed their response was inadequate. Among other things, concerns 
were expressed that the University had shown a lack of understanding 
for the victim, had communicated poorly with her, and had allowed her 
to be subjected to retaliatory harassment from other students. In 2008, 
the University's Board of Regents engaged an outside law firm (the Stolar 
Partnership) to conduct a detailed investigation. Their report (the Stolar 
Report) criticized some aspects of the University's policies and 
performance. 

Meanwhile, the incident received considerable publicity in the 
media. Articles appeared in which both football players were named. 
Beginning November 13, 2007, the Iowa City Press-Citizen served 
requests on the University under the Iowa Open Records Act. See Iowa 
Code § 22.2(1) (2011) ("Every person shall have the right to examine and 
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copy a public record. . ."J. 1 The requests sought, among other things, 
reports of attempted or actual sexual assaults; correspondence to or from 
various University officials relating to any such incidents; and e-mail, 
memos, and other records relating to any such incidents from October 1, 
2007 to the present. 

The University initially produced only eighteen pages of 
documents, claiming that any other responsive documents were 
protected from disclosure under Iowa Code section 22.7(1). See id. 
§ 22.7(1) (protecting from disclosure "[p]ersonal information in records 
regarding a student . . . maintained, created, collected or assembled by 
or for a school corporation or educational institution maintaining such 
records"). On January 4, 2008, the Press-Citizen filed a petition in 
district court seeking judicial enforcement of the Open Records Act. See 
id. § 22.10 (providing for civil enforcement of the Act). 

Shortly after bringing suit, the Press-Citizen filed a motion to 
compel. The motion asked the district court to order the University to 
produce a Vaughn index of the documents it was withholding. 2 It also 
urged that documents be produced in redacted form where necessary, 
without identifying individual students. The University resisted the 
motion to compel based on, among other things, FERPA. On August 7, 
2008, the district court granted the Press-Citizen's motion to compel. 



: For the sake of convenience, we will refer hereafter to the 201 1 Code version of 
chapter 22. During the pendency of this case, there have been no changes to that 
chapter that are material to our decision. 

2 In Vaughn v. Rosen, which arose under the Federal Freedom of Information Act, 
the D.C. Circuit ordered the government to produce a descriptive index of the 
documents it was withholding based on a claim they were exempt from production 
under the Act. 484 F.2d 820, 826-28 (D.C. Cir. 1973). As the Press-Citizen pointed 
out, a similar index was prepared by the school district in Des Moines Independent 
Community School District Public Records v. Des Moines Register & Tribune, Co., 487 
N.W.2d 666, 668 (Iowa 1992). That case arose under Iowa's Open Records Act. 
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The University thereafter released approximately 950 additional pages of 
documents to the Press-Citizen; prepared a Vaughn index for over 3000 
pages of documents (including both the pages that had been released 
and over 2000 that were being withheld); and submitted those 3000 
pages to the district court for in camera review. 

After conducting a painstaking in camera review, the district court 
entered another order on August 31, 2009. The order divided the 
University's documents into five categories: 

Category 1: documents already released by the 
University without redaction; 

Category 2: documents already released by the 
University with redactions; 

Category 3: documents "not protected as confidential 
and . . . subject to disclosure . . . without redaction"; 

Category 4: documents "subject to disclosure . . . with 
appropriate redactions made to remove student-identifying 
information including students' names, parents' names, 
addresses including E-mail addresses of students, dormitory 
and room numbers"; 

Category 5: "confidential documents not subject to 
disclosure under FERPA, Section 22.7 [of the Open Records 
Act], or attorney-client privilege rules." 

The district court's August 31 order directed the University to 
disclose the Category 3 documents without redaction and the Category 4 
documents with appropriate redactions within thirty days. On October 
5, 2009, the district court entered a final judgment incorporating the 
provisions of its August 31 order, again directing the disclosure of the 
documents, and also awarding the Press-Citizen $30,500 in attorneys' 
fees pursuant to Iowa Code section 22.10(3)(c). The University sought 
and obtained a stay of the district court's order pending appeal. The 
University now argues to us that the district court erred in ordering the 



7 

production of some of the Category 3 and all of the Category 4 
documents. 3 

II. Standard of Review. 

We review the district court's interpretations of chapter 22 and 
FERPA for errors at law. Rathmann v. Bd. of Dirs. of Davenport Cmty. 
Sch. Dist, 580 N.W.2d 773, 776 (Iowa 1998). We review of the court's 
application of those statutes de novo. Id. 

III. Analysis. 

A. The Iowa Open Records Act. Generally speaking, the Iowa 
Open Records Act (also known as the Examination of Public Records Act 
or the Iowa Freedom of Information Act) requires state and local entities 
to make their records available to the public. Iowa Code §§ 22.1(3), .2(1); 
see also City of Riverdale v. Diercks, 806 N.W.2d 643, 652 (Iowa 2011) 
(characterizing chapter 22 as "our state's freedom of information 
statute"). The Act seeks "to prevent government from secreting its 
decision-making activities from the public, on whose behalf it is its duty 
to act." Iowa Civil Rights Comm'n v. City of Des Moines, 313 N.W.2d 491, 
495 (Iowa 1981). We have said the Act establishes "a presumption of 
openness and disclosure." Gabrilson v. Flynn, 554 N.W.2d 267, 271 
(Iowa 1996). The University of Iowa, a state institution, is clearly covered 
by the Open Records Act; indeed, we have previously held that a private 
corporation commissioned by a state university to engage in fundraising 
for the university is covered by the Act. Gannon v. Bd. of Regents, 692 



3 The University appeals the district court's order to the extent it requires it to 
produce the following Category 3 documents: 133, 140-43, 202-03, 756-60, 835, 1009, 
1230, 1479, 1488-89, 1814, 1869-70, 1878, 1878-88, 1973, 1988-89, 1993-95, 2031, 
2043-44, 2055, 2062, 2063, 2217, 2234, 2251-56. We shall refer to them hereafter as 
the "appealed Category 3 documents." 
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N.W.2d 31, 42-44 (Iowa 2005) (holding that the Iowa State University 
and its private foundation were subject to the Open Records Act). 

The Open Records Act is subject to a number of listed exemptions, 
both large and small. See Iowa Code § 22.7 (stating that "[t]he following 
public records shall be kept confidential, unless otherwise ordered by a 
court, by the lawful custodian of the records, or by another person duly 
authorized to release such information" and listing sixty-four separate 
exceptions). Nonetheless, the University does not argue that any of those 
designated exceptions applies here. Its sole argument on appeal is that 
federal law, i.e., FERPA, requires the appealed Category 3 and the 
Category 4 documents to be kept confidential. 

B. FERPA. Congress enacted the Family Educational Rights and 
Privacy Act or FERPA in 1974 "under its spending power to condition the 
receipt of federal funds on certain requirements relating to the access 
and disclosure of student educational records." Gonzaga Univ. v. Doe, 
536 U.S. 273, 278, 122 S. Ct. 2268, 2272-73, 153 L. Ed. 2d 309, 318 
(2002). "The Act directs the Secretary of Education to withhold federal 
funds from any public or private 'educational agency or institution' that 
fails to comply with these conditions." Id. at 278, 122 S. Ct. at 2273, 
153 L. Ed. 2d at 318. The Act provides in part: 

No funds shall be made available under any applicable 
program to any educational agency or institution which has 
a policy or practice of permitting the release of education 
records (or personally identifiable information contained 
therein . . .) of students without the written consent of their 
parents to any individual, agency, or organization .... 

20 U.S.C. § 1232g(b)(l). It also provides: 

No funds shall be made available under any applicable 
program to any educational agency or institution which has 
a policy or practice of releasing, or providing access to, any 



personally identifiable information in education records . . . 
unless — 

(A) there is written consent from the student's parents. . . 
Id. § 1232g(b)(2). 

The Department of Education (DOE) has adopted regulations to 
implement FERPA. See 34 C.F.R. § 99.3 (2009). In relevant part, they 
define "education records" as follows: 

(a) The term means those records that are: 

(1) Directly related to a student; and 

(2) Maintained by an educational agency or institution 
or by a party acting for the agency or institution. 

(b) The term does not include: 

(1) Records that are kept in the sole possession of the 
maker, are used only as a personal memory aid, and are not 
accessible or revealed to any other person except a 
temporary substitute for the maker of the record. 

(2) Records of the law enforcement unit of an 
educational agency or institution .... 

(3) (i) Records relating to an individual who is employed 
by an educational agency or institution, that: 

(A) Are made and maintained in the normal course of 
business; 

(B) Relate exclusively to the individual in that 
individual's capacity as an employee; and 

(C) Are not available for use for any other purpose. 

Id. 

The same regulations define "personally identifiable information" 
as follows: 

The term includes, but is not limited to — 

(a) The student's name; 

(b) The name of the student's parent or other family 
members; 
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(c) The address of the student or student's family; 

(d) A personal identifier, such as the student's social 
security number, student number, or biometric record; 

(e) Other indirect identifiers, such as the student's 
date of birth, place of birth, and mother's maiden name; 

(f) Other information that, alone or in combination, is 
linked or linkable to a specific student that would allow a 
reasonable person in the school community, who does not 
have personal knowledge of the relevant circumstances, to 
identify the student with reasonable certainty; or 

(g) Information requested by a person who the 
educational agency or institution reasonably believes knows 
the identity of the student to whom the education record 
relates. 

Id. 

In light of these definitions, the University argues that the 
appealed Category 3 and the Category 4 documents cannot be produced 
at all. As it understands the law, "education records" with "personally 
identifiable information" cannot be released. Further, even if no student 
is actually identified in the document, either because his or her name 
and personal identifiers have been redacted or because the original 
document did not have that information, the regulations prohibit 
disclosure if the recipient would "know[] the identity of the student" — or 
"a reasonable person" would be able to "identify the student with 
reasonable certainty." See Id. In short, the University contends that if 
the Press-Citizen or the student community would know the student 
being discussed in the education record, the record cannot be divulged — 
even in redacted form — under FERPA. 

For purposes of this appeal, we assume that the appealed Category 
3 and Category 4 documents are in fact "education records" under 
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FERPA. 4 The Press-Citizen does not dispute that if these documents 
were produced, even in redacted form, it would be able to determine the 
students to whom the documents refer. 5 However, the Press-Citizen 
argues that FERPA is merely a funding statute that does not prohibit the 
disclosure of documents whose production is otherwise required by the 
Iowa Open Records Act. Alternatively, the Press-Citizen argues that 
FERPA does not allow the withholding of records, as opposed to their 
redaction. We now turn to these points of disagreement. 

C. The Interplay Between FERPA and the Open Records Act. 
The University argues that the relationship between FERPA and the 
Open Records Act is a simple matter of federal supremacy. See U.S. 
Const, art. VI (providing that the laws of the United States "shall be the 
supreme Law of the Land"). Iowa law, according to the University, 
cannot authorize disclosure where federal law requires confidentiality. 
The Press-Citizen, on the other hand, maintains that FERPA is not a 
positive law at all, but simply a funding provision, which cannot override 
the express directives of the Open Records Act. 

This debate has been played out in cases from other jurisdictions. 
Some courts have concluded that FERPA does not prohibit the disclosure 
of educational records. See Bauer v. Kincaid, 759 F. Supp. 575, 589 

4 The Press-Citizen (in a footnote) and the amici curiae (at more length) argue 
that some of the records may be "law enforcement" records rather than education 
records. See 20 U.S.C. § 1232g(a)(4)(B) (stating that "[t]he term 'education records' does 
not include . . . (ii) records maintained by a law enforcement unit of the educational 
agency or institution that were created by that law enforcement unit for the purpose of 
law enforcement"). This contention, however, was not raised below. Therefore, we may 
not consider it as part of the present appeal. See DeVoss v. State, 648 N.W.2d 56, 63 
(Iowa 2002) (declining to consider a ground for upholding the district court's ruling that 
was not presented below). In any event, we lack a sufficient record to do so. 

5 No one questions the thoroughness of the district court's in camera review and 
categorization of documents. The issues involved in the present appeal are simply legal 
ones. 
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(W.D. Mo. 1991) ("FERPA is not a law which prohibits disclosure of 
educational records. It is a provision which imposes a penalty for the 
disclosure of educational records."); WFTV, Inc. v. Sch. Bd. of Seminole, 
874 So. 2d 48, 57 (Fla. Dist. Ct. App. 2004) ("FERPA does not prohibit the 
disclosure of any educational records. FERPA only operates to deprive 
an educational agency or institution of its eligibility for applicable federal 
funding based on their policies and practices regarding public access to 
educational records if they have any policies or practices that run afoul 
of the rights of access and disclosural privacy protected by FERPA."); see 
also Kirwan v. The Diamondback, 721 A.2d 196, 206 (Md. 1998) 
("Another alternative argument made by The Diamondback is that the 
federal Family Educational Rights and Privacy Act does not directly 
prohibit the disclosure of protected education records, that the only 
enforcement mechanism under the Act is the withholding of funds from 
institutions having 'a policy or practice of permitting the release of 
education records' ... [I]n light of our holding that the records are not 
education records within the meaning of the federal statute, we need not 
and do not reach this issue." (citation omitted)). 

FERPA regulations allow for the possibility that an educational 
institution "cannot comply with the Act or this part due to a conflict with 
State or local law." See 34 C.F.R. § 99.61. One could argue that the 
mere recognition of this possibility in the regulations indicates that 
FERPA does not supersede state law. 6 

6 In one case where a school district disclosed publicly what it was paying for a 
student's out-of-state special education services, arguing that South Dakota law 
required release of this information, the DOE advised the district that FERPA "does not 
act to preempt conflicting State laws." Letter from LeRoy S. Rooker, 20 IDELR 105, 106 
(May 14, 1993). It also stated, however, that disclosure without consent "will violate 
FERPA and jeopardize [the district's] continued receipt of Federal education funds." In 
subsequent litigation over the same incident, a federal district court granted summary 
judgment to the school district, reasoning, "The school board cannot be liable for 
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On the other hand, other courts have given direct effect to FERPA's 
provisions, treating them as positive law with binding force on state 
authorities. See Sherry v. Radnor Twp. Sch. Dist, 20 A.3d 515, 525 (Pa. 
Cmwth. Ct. 2011) (finding that the release of the requested reports "was 
precluded by FERPA"). In United States v. Miami University, 294 F.3d 
797, 803 (6th Cir. 2002), a federal court of appeals affirmed an 
injunction against the release of student disciplinary records covered by 
FERPA. The court reasoned that the remedies for FERPA violations were 
not limited to a cutoff of federal funding. Miami Univ., 294 F.3d at 809- 
10. Rather, once funds are accepted, "the school is indeed prohibited 
from systematically releasing education records without consent." Id. at 
809; see also Rim of the World Unified Sch. Dist. v. Super. Ct, 129 Cal. 
Rptr. 2d 11, 15 (Ct. App. 2002) (finding that FERPA preempts California 
law requiring the disclosure of student expulsion records); 
Unincorporated Operating Div. of Ind. Newspapers, Inc. v. Trs. of Ind. 
Univ., 787 N.E.2d 893, 904 (Ind. Ct. App. 2003) (stating that "FERPA is a 
federal law which requires education records to be kept confidential"). 

In short, as one court has observed, "state and federal courts are 
sharply divided on this issue." Caledonian-Record Publ'g Co. v. Vt. State 
Colls., 833 A.2d 1273, 1274-76 (Vt. 2003) (citing cases). 

We need not step into this controversy here, however, because we 
believe a provision of the Iowa Open Records Act already gives priority to 
FERPA. Section 22.9 of the Act provides: 

complying with a state law which was not clearly preempted by federal law." Maynard 
v. Greater Hoyt Sch. Dist. No. 61-4, 876 F. Supp. 1104, 1108 (D.S.D. 1995). However, 
DOE's position in the Maynard matter must be considered together with its later 
position in United States v. Miami University, 294 F.3d 797 (6th Cir. 2002) (discussed 
below). In Miami University, DOE took the position, successfully, that FERPA barred 
the release of education records whose disclosure would otherwise have been required 
by Ohio law. Miami Univ., 294 F.3d at 811. Thus, from the Miami University case, one 
could infer that 34 C.F.R. § 99.61 simply serves as an enforcement mechanism. 
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If it is determined that any provision of this chapter 
would cause the denial of funds, services or essential 
information from the United States government which would 
otherwise definitely be available to an agency of this state, 
such provision shall be suspended as to such agency, but 
only to the extent necessary to prevent denial of such funds, 
services, or essential information. 

An agency within the meaning of section 17A.2, 
subsection 1, shall adopt as a rule, in each situation where 
this section is believed applicable, its determination 
identifying those particular provisions of this chapter that 
must be waived in the circumstances to prevent the denial of 
federal funds, services, or information. 

Otherwise stated, the first paragraph of section 22.9 suspends the 
operation of a provision of the Open Records Act if the provision would 
cause the denial of federal funds to a state agency. This paragraph, we 
believe, answers the Press-Citizen's argument that FERPA in and of itself 
is not a positive law. Section 22.9 gives it the effect of a positive law. If 
the University regularly released educational records pursuant to section 
22.2(1) of the Open Records Act, it would be engaging in a "practice" of 
permitting the release of confidential education records, assuming the 
records contained "personally identifiable information." See 20 U.S.C. 
§ 1232g(b)(l). The sanction for this would be a loss of federal funding. 
See 20 U.S.C. §§ 1232c, 1234c (authorizing the withholding of funds 
when a recipient "is failing to comply substantially with any requirement 
of law applicable to such funds"); see also id. § 1232g(f) (providing that 
"[t]he Secretary shall take appropriate actions to enforce this section and 
to deal with violations of this section, in accordance with this chapter, 
except that action to terminate assistance may be taken only if the 
Secretary finds there has been a failure to comply with this section, and 
he has determined that compliance cannot be secured by voluntary 
means"). 
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The Press-Citizen responds that the University has not shown the 
disclosure of records would "definitely" cause it to lose funds as required 
by the first paragraph of section 22. This argument, we believe, misreads 
the statute. Section 22.9 requires that the federal funds be "definitely 
available." That they are. The University enjoys considerable federal 
support. See University of Iowa, General Education Fund, FY 201 1 — Use 
of New Revenues and Reallocations (2011), available at 
www.uiowa.edu/~fusbudg/201 l_final_budget_spread.pdf (disclosing 
total federal support of $258,999,082 for the University in fiscal year 
2009). The statute does not have similar language requiring that the loss 
be definite. 

The Press-Citizen urges, however, that a one-off production of 
records in this case would not amount to a "policy or practice." See 
Gonzaga Univ., 536 U.S. at 288, 122 S. Ct. at 2278, 153 L. Ed. 2d at 324 
(noting that FERPA's nondisclosure provisions "speak only in terms of 
institutional policy and practice, not individual instances of disclosure" 
and "have an aggregate focus" (citation)); see also Achman v. Chisago 
Lakes Indep. Sch. Dist. No. 2144, 45 F. Supp. 2d 664, 674 (D. Minn. 
1999) (finding that "a solitary violation is insufficient to support a finding 
that the District has violated FERPA as a matter of policy or practice"). 
One problem with this argument, however, is that the production would 
not be accidental or inadvertent and would necessarily set some kind of 
precedent after having been authorized by the Iowa courts. A "policy or 
practice" to some extent would be established. 7 



"While the "policy or practice" must be of the "educational agency or institution," 
see 20 U.S.C. § 1232g(b), nothing in FERPA requires that it be a voluntary practice of 
the university, as opposed to one compelled by state law. 
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The larger problem with the Press-Citizen's position is that section 
22.9 also operates on an aggregate basis. That section asks us to 
consider not whether a specific production of records in a particular case 
would result in a loss of funds, but whether a "provision" — e.g., section 
22.2(1), the overall legal requirement that public records be made 
available — would cause such a loss. Hence, we need to focus on the 
provision itself, not just a one-time application of it, and determine 
whether that provision would lead to a loss of federal funding for the 
agency. In other words, section 22.9 requires us to consider whether 
section 22.2(1), the basic open records "provision," applied consistently 
to education records at the University of Iowa, i.e., "an agency of this 
state," would "cause the denial of funds," and if so it "suspend[s]" that 
provision. 8 

Of course, at the end of the day the federal government might not 
try to defund the University of Iowa regardless of the circumstances. But 
we do not think section 22.9 requires Iowa courts to make predictions 
about policy decisions made in Washington D.C. That would be 
unworkable. See Iowa Code § 4.4(3) (setting forth a presumption that "[a] 
just and reasonable result is intended"). As we read the first paragraph 
of section 22.9, it requires us to withhold legal effect from a provision of 
the Open Records Act, such as section 22.2(1), if it appears that 



8 Again, Iowa Code section 22.9 does not ask whether a specific disclosure would 
result in loss of funding, but whether a provision of the Open Records Act as applied to 
a state agency would result in loss of funding. 

Neither party disputes that the University of Iowa is an agency within the 
meaning of Iowa Code sections 22.9 and 17A.2. See, e.g., Papadakis v. Iowa State Univ. 
of Sci. & Tech., 574 N.W.2d 258, 260-61 (Iowa 1997) (finding that a university's 
termination of a faculty member's salary and benefits constituted "agency action" within 
the meaning of section 17A.2(2)). 
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provision (not just an isolated application of the provision) would result 
in a loss of federal funding for a state agency. 

The Press-Citizen also relies on the second paragraph of section 
22.9. It urges that the University has failed to adopt a "rule" as required 
by that paragraph and, in the absence of such a rule, the first paragraph 
has no effect. 9 When the Open Records Act was originally enacted in 
1967, only the first paragraph of section 22.9 was included. See 1967 
Iowa Acts ch. 106, § 11 (codified at Iowa § 68A.9 (1971), now Iowa Code 
§ 22.9). The second paragraph was not added until 1984. See 1984 
Iowa Acts ch. 1 185, § 8 (codifed at Iowa Code § 22.9 (1985)). 

Our difficulty with this argument is that it treats two separate 
mechanisms as if they were one. The first paragraph of section 22.9 is 
written in the passive voice ("shall be suspended") and is directed at 
everyone. Thus, the first paragraph comes into effect whenever "it is 
determined," without confining itself to determinations by an agency. By 
contrast, the second paragraph is directed to agencies of this state, 
telling each of them to adopt by rule "in each situation where [section 
22.9] is believed applicable, its determination identifying those particular 
provisions of this chapter that must be waived in the circumstances to 
prevent the denial of federal funds, services, or information." See also 

9 The University argues that Iowa Administrative Code rule 681 — 17.13(2)(d) is 
such a rule. It provides: 

The following records shall be kept confidential. Records are listed by 
category, according to the legal basis for withholding them from public 
inspection. 

d. Student records (Family Educational Rights and Privacy Act of 
1974, as amended, 20 U.S.C. 1232g and Iowa Code section 22.7) 

In light of our determination that adoption of a rule under the second paragraph 
of section 22.9 is not a prerequisite to the enforcement of the first paragraph of that 
section, we need not reach this argument. 
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S.F. 2294 Explanation, 70th G.A., Reg. Sess. (Iowa 1984) ("Section 8 
requires state agencies to adopt certain rules regarding conditions of 
federal funds."). There is no indication in any part of section 22.9 that if 
an agency should fail to discharge its duty under the second paragraph, 
or should discharge it incorrectly, the legislature intended the first 
paragraph to have no effect. After all, the first paragraph was a stand- 
alone provision with independent force for seventeen years before the 
second paragraph was enacted. In sum, we believe the 1984 amendment 
simply imposed a new obligation on state agencies, without altering the 
preexisting law. We therefore find that the Open Records Act 
incorporates confidentiality obligations from FERPA. 

D. FERPA and "Personally Identifiable Information." 
Assuming FERPA applies, the next issue is whether its obligations can be 
met by redaction or whether it requires the withholding of entire records 
in some instances. The University argues that under the DOE's 
interpretation of "personally identifiable information," an educational 
record must be withheld if the recipient would know the student to 
whom the record refers, even with the redaction of personal information, 
such as the student's name. See 34 C.F.R. § 99.3 (defining personally 
identifiable information to include "[information requested by a person 
who the educational agency or institution reasonably believes knows the 
identity of the student to whom the education record relates"). Given the 
notoriety of the October 14, 2007 incident, the University contends that 
no amount of redaction of personal information would prevent the 
newspaper from knowing the identity of various persons referenced in 
records relating to that incident. 

The Press-Citizen responds that under the Open Records Act, 
access is a yes-or-no proposition. It cannot vary based upon the identity 
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of the party making the request. See, e.g., Ne. Council on Substance 
Abuse, Inc. v. Iowa Dep't of Pub. Health, 513 N.W.2d 757, 761 (Iowa 
1994) (rejecting a party's contention under the Open Records Act "that 
release of the applications should depend on the status of the party 
seeking them"). The flaw in this argument, however, is that the relevant 
legal standards in this case actually come from FERPA, incorporated into 
Iowa law through section 22.9. 

The Press-Citizen also maintains that the DOE regulation should 
not be followed, either because the relevant part of it did not become 
effective until this lawsuit was already pending or because it is contrary 
to prior caselaw. As noted by the Press-Citizen, current subparts (f) and 
(g) of the definition of "personally identifiable information" were only 
approved as a final rule by the DOE on December 9, 2008, and became 
effective January 9, 2009. See Family Educational Rights and Privacy, 
73 Fed. Reg. 74,806, 74,806 (December 9, 2008) (codified at 34 C.F.R. pt. 
99). This action was filed January 4, 2008. The district court rendered 
its decision on the Category 3 and Category 4 documents on August 31, 
2009. 

Yet under federal law, there exists a "principle that a court is to 
apply the law in effect at the time it renders its decision, unless doing so 
would result in manifest injustice or there is statutory direction or 
legislative history to the contrary." Bradley v. Sch. Bd. of Richmond, 416 
U.S. 696, 711, 94 S. Ct. 2006, 2016, 40 L. Ed. 2d 476, 488 (1974). True, 
there is also the "principle that the legal effect of conduct should 
ordinarily be assessed under the law that existed when the conduct took 
place." Kaiser Aluminum & Chem. Corp. v. Bonjorno, 494 U.S. 827, 855, 
110 S. Ct. 1570, 1586, 108 L. Ed. 2d 842, 865 (1990) (Scalia, J., 
concurring). Thus, the United States Supreme Court has asked whether 
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applying the change in law to a pending case "would impair rights a 
party possessed when he acted, increase a party's liability for past 
conduct, or impose new duties with respect to transactions already 
completed." Landgraf v. USI Film Prods., 511 U.S. 244, 280, 114 S. Ct. 
1483, 1505, 128 L. Ed. 2d 229, 262 (1994); see also Fernandez-Vargas v. 
Gonzales, 548 U.S. 30, 37, 126 S. Ct. 2422, 2427-28, 165 L. Ed. 2d 323, 
334 (2006). 

We think the modified definition of "personally identifiable 
information" easily passes the federal test for retroactivity. The relevant 
"conduct" here is the University's decision to withhold the appealed 
Category 3 and the Category 4 documents. That conduct continued after 
the lawsuit was filed. It was still ongoing even when the regulation was 
modified. There was no reliance such that there would be prejudice if we 
followed the new regulation. 

Also, the previous definition of "personally identifiable information" 
was not all that different. It prohibited the disclosure of any "information 
that would make the students' identities easily traceable." 34 C.F.R. 
§ 99.3(f) (2008). The DOE substituted the new language because the old 
language 

lacked specificity and clarity. We were also concerned that 
the "easily traceable" standard suggested that a fairly low 
standard applied in protecting education records, i.e., that 
information was considered personally identifiable only if it 
was easy to identify the student. 

73 Fed. Reg. 74,806, 74,831 (December 9, 2008). 

But the DOE had issued guidance under the earlier language that 
educational records could not be released if the recipient could determine 
the student to whom reference was being made: 

If, because of other records that have been released, or other 
publicly available information, the redaction of names, 
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identification numbers, and dates and times of incidents is 
not sufficient to prevent the identification of a student 
involved in a disciplinary proceeding, including student 
victims and student witnesses, then FERPA prohibits an 
educational agency or institution from having a policy or 
practice of releasing the information. 

See Letter to School District re: Disclosure of Education Records to Texas 
Office of Attorney General (April 6, 2006), available at 
www2.ed.gov/ policy/ gen/ guid/fpco / ferpa/ library/ tx040606.html. As 
DOE explained in its notice of proposed rulemaking for the amendment, 
"The proposed regulations are needed to establish this guidance in a 
definitive and legally binding interpretation . . . ." Family Educational 
Rights and Privacy, 73 Fed. Reg. 15574, 15583 (March 24, 2008). 
Hence, the intent of the January 2009 amendment was to clarify the law, 
not change it. 

The Press-Citizen also insists that it is not a legally permissible 
construction of the term "personally identifiable information" for the 
University to withhold entire documents, rather than redact them. We 
disagree. The statute forbids federal funding of institutions that have a 
policy or practice of releasing "education records (or personally 
identifiable information contained therein . . . )" without parental 
permission. See 20 U.S.C. § 1232g(b)(l). This either-or language, as we 
read it, is at least subject to the interpretation that an entire record can 
be withheld where redaction would not be enough to protect the identity 
of a student. And as long as the underlying statute is ambiguous, we are 
required to defer to any reasonable and permissible interpretation made 
by the agency — here DOE. See Chevron U.S.A., Inc. v. Natural Res. Def. 
Council, Inc., 467 U.S. 837, 842-43, 104 S. Ct. 2778, 2781-82, 81 L. Ed. 
2d 694, 702-03 (1984); Miami Univ., 294 F.3d at 814. 
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The Press-Citizen cites to a case where the Montana Supreme 
Court ordered release of student disciplinary records with the names 
redacted, even though the two students involved were known to the 
requesting newspaper. Bd. of Trs., Cut Bank Pub. Schs. v. Cut Bank 
Pioneer Press, 160 P.3d 482, 487 (Mont. 2007). But that case was 
decided before the 2009 amendment to the FERPA regulations. In any 
event, the school district never made the specific argument, as far as we 
can tell, that FERPA prohibits release of an entire record where redaction 
would not be enough to avoid identification of the students involved. The 
Press-Citizen also cites to a passing observation of the Wisconsin 
Supreme Court that "once personally identifiable information is deleted, 
by definition, a record is no longer an education record since it is no 
longer directly related to a student." Osborn v. Bd. of Regents of Univ. of 
Wis. Sys., 647 N.W.2d 158, 168 n. 11 (Wis. 2002). That comment also 
was made before the 2009 amendment to the regulations, and that case 
likewise did not address the particular issue that is now before us. 

Thus, consistent with current DOE regulations, we conclude that 
educational records may be withheld in their entirety where the 
requester would otherwise know the identity of the referenced student or 
students even with redactions. 

The Press-Citizen criticizes this position as a matter of policy. In 
its view: "The University's position boils down to a peculiar argument 
that FERPA applies on a sliding scale, saving its most vigorous 
application to records concerning crimes and alleged crimes that are the 
most notorious." This feature of FERPA, however, derives from earlier 
determinations by Congress and the DOE that preservation of student 
confidentiality should be an overarching goal of the statute. It is not our 
role to reexamine those decisions. 
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E. Additional Issues. The Press-Citizen points out that FERPA 
has an exception when education records are "furnished in compliance 
with judicial order, or pursuant to any lawfully issued subpoena, upon 
condition that parents and the students are notified of all such orders or 
subpoenas in advance of the compliance therewith by the educational 
institution." See 20 U.S.C. § 1232g(b)(2)(B); see also 34 C.F.R. 
99.31(a)(9)(i) (2009) (indicating that an education record may be 
disclosed "to comply with a judicial order or lawfully issued subpoena"). 
This exception has been applied in prior cases. See, e.g., Ragusa v. 
Malveme Union Free Sch. Dist, 549 F. Supp. 2d 288, 293-94 (E.D.N.Y. 
2008) (ordering the production of relevant education records in a 
discrimination case); Catrone v. Miles, 160 P.3d 1204, 1210-12 (Ariz. Ct. 
App. 2007) (holding that education records could be ordered to be 
produced in a medical malpractice case and noting "the protections 
afforded to educational records by statute do not prohibit, but rather 
permit, disclosure pursuant to court order"); Gaumond v. Trinity 
Repertory Co., 909 A.2d 512, 518 (R.I. 2006) (holding that FERPA does 
not bar the production of relevant education records pursuant to court 
order in a personal injury case). But in those instances, the records were 
relevant to litigation that did not involve the records themselves. See 
Gaumond, 909 A.2d at 518 (distinguishing prior cases where public 
disclosure was sought by newspapers and was not granted). It would 
make no sense to interpret the "judicial order" exception as authorizing 
disclosure whenever a party chose to bring a separate court action 
seeking access to education records. This would lead to a highly 
incongruous situation where FERPA would only have effect until the 
party requesting records chose to go to court, at which point FERPA 
would cease to have any effect at all. 10 



10 Courts have rejected that viewpoint. See Ragusa, 549 F. Supp. 2d at 292 
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The Press-Citizen also argues that the University has been 
inconsistent in its position. As the Press-Citizen points out, University 
officials, including the president, the athletic director, and the football 
coach have commented publicly on aspects of the University's response 
to the alleged sexual assault. In addition, the seventy-two-page Stolar 
Report that was commissioned by the Board of Regents contains a 
detailed narrative and critique of the University's response to the 
incident, replete with references to "Football Player #1," "Football Player 
#2," and "the Student- Athlete." 

We are not persuaded that the University has been altogether 
consistent. At the same time, commentators have criticized FERPA for 
permitting institutions to behave inconsistently — revealing student 
information when it puts the university in a good light and withholding it 
when it does not. See Matthew R. Salzwedel & Jon Ericson, Cleaning Up 
Buckley: How the Family Educational Rights and Privacy Act Shields 
Academic Corruption in College Athletics, 2003 Wis. L. Rev. 1053, 1105- 
06 (2003) (commenting that universities "provide disclosure that is 
selective in application"). Regardless, the Press-Citizen does not attach 
any particular legal significance to the University's alleged inconsistency. 
It provides no legal authority in this section of its brief and, at oral 
argument, specifically disclaimed any waiver argument. Cf. City of 
Riverdale, 806 N.W.2d at 657 (finding a municipality had waived the 

(stating that the judicial order exception to FERPA does not end the inquiry and 
observing that " "before approval is given, the party seeking disclosure is required to 
demonstrate a genuine need for the information that outweighs the privacy interests of 
the students' " (quoting Rios v. Read, 73 F.R.D. 589, 599 (E.D.N.Y. 1977))); see also Zaal 
v. State, 602 A.2d 1247, 1256 (Md. 1992) (commenting "[t]hat the statute exempts a 
local school system or educational institution which discloses 'personally identifiable 
information' in compliance with a judicial order from sanctions does not mean that a 
student's privacy or confidentiality interest in his or her education records is 
automatically overridden whenever a court order to review them is sought"). In short, 
the "judicial order" exception informs an educational institution when it may release 
educational records; it does not inform a court when it may enter an order. 
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exemption in section 22.7(50) of the Open Records Act). For these 
reasons, the Press-Citizen's inconsistency argument does not alter our 
conclusions as to what FERPA requires in this case. 

The amici curiae urge that it would violate federal and state 
constitutional provisions if access to public documents could depend 
upon the knowledge or identity of the requester. Although this argument 
is developed at some length in the brief of the amici, it was not raised 
below or by the Press-Citizen. We therefore decline to reach it. See 
Mueller v. St. Ansgar State Bank, 465 N.W.2d 659, 660 (Iowa 1991) 
(noting that "[u]nder Iowa law, the only issues reviewable are those 
presented by the parties"); see also Rants v. Vilsack, 684 N.W.2d 193, 
198-99 (Iowa 2004) (declining to reach an argument raised by amici 
curiae that was not presented to the district court). 

IV. Conclusion. 

We reverse the judgment of the district court to the extent it orders 
the production of the appealed Category 3 documents and the Category 4 
documents. The University has not challenged any other aspects of the 
district court's judgment, including its award of attorneys' fees to the 
Press-Citizen. Therefore, we affirm the remainder of the judgment. 11 We 
remand for further proceedings in accordance with this opinion. 

DISTRICT COURT JUDGMENT REVERSED IN PART AND 
REMANDED. 

All justices concur except Appel, Wiggins, and Hecht, JJ., who 
dissent. 



"The Press-Citizen contends in its brief that the University has failed to produce 
even the Category 3 records that are not the subject of this appeal. Their production 
should occur, if it has not already taken place. 
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#09-1612, Press Citizen Co. v. Univ. of Iowa 

APPEL, Justice (dissenting). 

I respectfully dissent. 

The Federal Educational Rights and Privacy Act (FERPA) states 
that federal funds shall not be available "to any educational agency or 
institution which has a policy or practice" of releasing personally 
identifiable information without the written consent of parents. 20 
U.S.C. § 1232g(b)(l) (2006). In my view, compliance with a judicial order 
pursuant to a generally applicable state public records statute does not 
amount to a policy or practice of any educational agency or institution. 
See generally Maynard v. Greater Hoyt Sch. Dist. No. 61-4, 876 F. Supp. 
1104, 1108 (D.S.D. 1995). The majority opinion repeatedly cites "policy 
or practice," while omitting the statutory requirement that the "policy or 
practice" must be one of the "educational agency or institution." In 
effect, the majority opinion amends the statute to strike the words 
"agency or institution." 

In light of this explicit wording of FERPA and the Iowa Open 
Records Act, I would not rewrite either statute. While federal law plainly 
is supreme, I find no conflict between FERPA and the Iowa Public 
Records Act. As a result, I would require disclosure of the public records 
in this case. 

Wiggins and Hecht, JJ., join this dissent. 



